Skip to content

Commit d4345e0

Browse files
steve-googdplore
steve-goog
and
dplore
authored
PF-1.17 MACsec updates to clarify test setup (#4926)
* Update feature/policy_forwarding/otg_tests/mpls_gre_udp_macsec/README.md * Regenerate canonical JSON * add replay-protection to Ethernet interface --------- Co-authored-by: Darren Loher <dloher@google.com>
1 parent c12f18f commit d4345e0

File tree

1 file changed

+117
-108
lines changed
  • feature/policy_forwarding/otg_tests/mpls_gre_udp_macsec

1 file changed

+117
-108
lines changed

‎feature/policy_forwarding/otg_tests/mpls_gre_udp_macsec/README.md‎

Lines changed: 117 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -22,27 +22,26 @@ Test uses aggregate 802.3ad bundled interfaces (Aggregate).
2222
* Send bidirectional traffic:
2323
* IP to Encap Traffic: The IP to Encap traffic is from ATE Ports [1,2] to ATE Ports [3,4,5,6].
2424

25-
* Encap to IP Traffic: The Encap traffic to IP traffic is from ATE Ports [3,4,5,6] to ATE Ports [1,2].
25+
* Encap to IP Traffic: The Encap traffic to IP traffic is from ATE Ports [3,4,5,6] to ATE Ports [1,2].
2626

2727
Please refer to the MPLSoGRE [encapsulation PF-1.14](feature/policy_forwarding/otg_tests/mpls_gre_ipv4_encap_test/README.md) and [decapsulation PF-1.12](feature/policy_forwarding/otg_tests/mpls_gre_ipv4_decap_test/README.md) READMEs for additional information on the test traffic environment setup.
2828

2929
## PF-1.17.1: Generate DUT Configuration
3030
### MACsec
3131
* Configure MACsec Static Connectivity Association Key (CAK) Mode on both ends of the aggregate bundle links connecting ATE ports 1,2 and DUT:
32-
* Define first Policy(1) to cover must-secure scenario
33-
* Define second Policy(2) to cover should-secure scenario
32+
* Define first Policy(1) to cover must-secure scenario, as defined below
33+
* Define second Policy(2) to cover should-secure scenario, as defined below
3434
* Define 5 pre-shared keys (with overlapping time of 1 minute and lifetime of 2 minutes) for both Policy(1) and Policy(2)
35-
* Each pre-shared key mush have a unique Connectivity Association Key Name(CKN) and Connectivity Association Key(CAK)
36-
* Set CKN as encrypted/hidden in the running configuration
35+
* Each pre-shared key must have a unique Connectivity Association Key Name(CKN) and Connectivity Association Key(CAK)
36+
* Set CAK as encrypted/hidden in the running configuration
3737
* Use 256 bit cipher GCM-AES-256-XPN and an associated 64 char CAK-CKN pair
3838
* Set Key server priority: 15
39-
* Set Security association key rekey interval: 28800 seconds
39+
* Set Security association key rekey interval: 30 seconds (test only)
4040
* Set MACsec confidentiality offset: 0
41-
* Set Replay Protection Window size: 64
42-
* Set ICV enabled:True
43-
* Set SCI enabled:True
44-
* Set Out of sequence protection window size:64
45-
* Set maximum value of Association Number: 3 (NOTE: This is currently not configurable)
41+
* Set Replay Protection Window (out-of-sequence protection) size: 64
42+
* Include ICV indicator:True
43+
* Include SCI:True
44+
* Set maximum value of Association Number: 3 (NOTE: This is currently not configurable and is not included in the test cases)
4645

4746
## PF-1.17.2: Verify PF MPLSoGRE and MPLSoGUE traffic forwarding with MACSec must-secure policy
4847
* Generate bidirectional traffic as highlighted in the test environment setup section:
@@ -57,7 +56,7 @@ Verify:
5756
* No packet loss while forwarding at line rate
5857
* Traffic equally load-balanced across bundle interfaces in both directions
5958
* Header fields are as expected in both directions
60-
* Traffic is dropped (100 percent) when the must-secure MACSec sessions are down by disabling MACsec on ATE ports
59+
* Traffic is dropped (100 percent) when the must-secure MACSec sessions are down by changing a key on one side to a mismatch & forcing renegotiation on ATE ports
6160

6261
## PF-1.17.3: Verify PF MPLSoGRE and MPLSoGUE traffic forwarding with MACSec should-secure policy
6362
* Generate bidirectional traffic as highlighted in the test environment setup section:
@@ -72,7 +71,7 @@ Verify:
7271
* No packet loss while forwarding at line rate
7372
* Traffic equally load-balanced across bundle interfaces in both directions
7473
* Header fields are as expected in both directions
75-
* Traffic is not dropped when the should-secure MACSec sessions are down by disabling MACsec on ATE ports
74+
* Traffic is not dropped when the should-secure MACSec sessions are down by changing a key on one side to a mismatch & forcing renegotiation on ATE ports
7675

7776
## PF-1.17.4: Verify MACSec key rotation
7877
* Generate bidirectional traffic as highlighted in the test environment setup section:
@@ -90,119 +89,129 @@ Verify:
9089
* No packet loss when keys one through five expires as configured
9190
* 100 percent packet loss after all the keys configured expires
9291

92+
## PF-1.17.5: Verify standard Security-Association timer
93+
* Generate bidirectional traffic as highlighted in the test environment setup section:
94+
* MPLSoGRE traffic with IPV4 and IPV6 payloads from ATE ports 3,4,5,6
95+
* MPLSoGUE traffic with IPV4 and IPV6 payloads from ATE ports 3,4,5,6
96+
* IPV4 and IPV6 traffic from ATE ports 1,2
97+
* Use 64, 128, 256, 512, 1024.. MTU bytes frame size.
98+
* Enable must secure policy (Policy(1)) on both interfaces ATE ports 1,2 and DUT
99+
* Set the security association key rekey interval to 28800 seconds
93100

94-
## Canonical OpenConfig for MACsec configuration
101+
Verify:
102+
* Verify the SAK key value is accepted by the DUT
103+
* Verify that MACsec sessions are up
104+
* No packet loss while forwarding at line rate
105+
106+
## Definitions
107+
* *must-secure:* All non-macsec-control packets must be encrypted. On transmit (tx), packets are dropped if encryption is not used or if keys have expired. On receive (rx), unencrypted packets that should be secure or encrypted with expired keys are dropped.
108+
* *should-secure:* Unencrypted packets are permitted. On receive (rx), it's recommended but not required to drop unencrypted packets if a macsec session is active. On transmit (tx), it's recommended but not required to send unencrypted packets if macsec session negotiation has failed.
109+
110+
## Canonical OC
95111

96112
```json
97113
{
98-
"macsec": {
99-
"interfaces": {
100-
"interface": [
101-
{
102-
"config": {
103-
"enable": true,
104-
"name": "Ethernet12/1",
105-
"replay-protection": 64
106-
},
107-
"mka": {
108-
"config": {
109-
"key-chain": "my_macsec_keychain",
110-
"mka-policy": "must_secure_policy"
111-
}
112-
},
113-
"name": "Ethernet12/1"
114-
},
115-
{
116-
"config": {
117-
"enable": true,
118-
"name": "Ethernet11/1",
119-
"replay-protection": 64
120-
},
121-
"mka": {
122-
"config": {
123-
"key-chain": "my_macsec_keychain",
124-
"mka-policy": "must_secure_policy"
125-
}
126-
},
127-
"name": "Ethernet11/1"
128-
}
129-
]
114+
"interfaces": {
115+
"interface": [
116+
{
117+
"config": {
118+
"name": "Ethernet1/1"
119+
},
120+
"name": "Ethernet1/1"
121+
},
122+
{
123+
"config": {
124+
"name": "Ethernet1/2"
130125
},
131-
"mka": {
132-
"policies": {
133-
"policy": [
134-
{
135-
"config": {
136-
"confidentiality-offset": "0_BYTES",
137-
"include-icv-indicator": true,
138-
"include-sci": true,
139-
"key-server-priority": 15,
140-
"macsec-cipher-suite": [
141-
"GCM_AES_XPN_256"
142-
],
143-
"name": "must_secure_policy",
144-
"sak-rekey-interval": 28800,
145-
"security-policy": "MUST_SECURE"
146-
},
147-
"name": "must_secure_policy"
148-
},
149-
{
150-
"config": {
151-
"confidentiality-offset": "0_BYTES",
152-
"include-icv-indicator": true,
153-
"include-sci": true,
154-
"key-server-priority": 15,
155-
"macsec-cipher-suite": [
156-
"GCM_AES_XPN_256"
157-
],
158-
"name": "should_secure_policy",
159-
"sak-rekey-interval": 28800,
160-
"security-policy": "SHOULD_SECURE"
161-
},
162-
"name": "should_secure_policy"
163-
}
164-
]
126+
"name": "Ethernet1/2"
127+
}
128+
]
129+
},
130+
"keychains": {
131+
"keychain": [
132+
{
133+
"config": {
134+
"name": "keychain1"
135+
},
136+
"keys": {
137+
"key": [
138+
{
139+
"config": {
140+
"crypto-algorithm": "AES_256_CMAC",
141+
"key-id": "0xabcd111122223333444455556666777788889999000011112222333344445555",
142+
"secret-key": "ad4rf10kn85fc0adk5dfcsnr1or4cm08q"
143+
},
144+
"key-id": "0xabcd111122223333444455556666777788889999000011112222333344445555"
145+
}
146+
]
147+
},
148+
"name": "keychain1"
149+
}
150+
]
151+
},
152+
"macsec": {
153+
"interfaces": {
154+
"interface": [
155+
{
156+
"config": {
157+
"enable": true,
158+
"name": "Ethernet1/1",
159+
"replay-protection": 64
160+
},
161+
"mka": {
162+
"config": {
163+
"key-chain": "keychain1",
164+
"mka-policy": "must_secure"
165+
}
166+
},
167+
"name": "Ethernet1/1"
168+
},
169+
{
170+
"config": {
171+
"enable": true,
172+
"name": "Ethernet1/2",
173+
"replay-protection": 64
174+
},
175+
"mka": {
176+
"config": {
177+
"key-chain": "keychain1",
178+
"mka-policy": "must_secure"
165179
}
180+
},
181+
"name": "Ethernet1/2"
166182
}
183+
]
167184
},
168-
"keychains": {
169-
"keychain": {
185+
"mka": {
186+
"policies": {
187+
"policy": [
188+
{
170189
"config": {
171-
"name": "my_macsec_keychain"
190+
"confidentiality-offset": "0_BYTES",
191+
"include-icv-indicator": true,
192+
"include-sci": true,
193+
"key-server-priority": 15,
194+
"macsec-cipher-suite": [
195+
"GCM_AES_XPN_256"
196+
],
197+
"name": "must_secure",
198+
"sak-rekey-interval": 30
172199
},
173-
"keys": {
174-
"key": [
175-
{
176-
"config": {
177-
"secret-key": "sercret password/CAK",
178-
"key-id": "key-id/CKN",
179-
"crypto-algorithm": "AES_256_CMAC",
180-
"send-lifetime": {
181-
"config": {
182-
"start-time": "my_start_time",
183-
"end-time": "my_end_time"
184-
}
185-
},
186-
"receive-lifetime": {
187-
"config": {
188-
"start-time": "my_start_time",
189-
"end-time": "my_end_time"
190-
}
191-
}
192-
}
193-
}
194-
]
195-
}
196-
}
200+
"name": "must_secure"
201+
}
202+
]
203+
}
197204
}
205+
}
198206
}
199-
```
207+
```
200208

201209
## OpenConfig Path and RPC Coverage
202210
TODO: Finalize and update the below paths after the review and testing on any vendor device.
203211

204212
```yaml
205213
paths:
214+
# TODO: /macsec/mka/config/security-policy MUST_SECURE,SHOULD_SECURE
206215
/macsec/interfaces/interface/state/name:
207216
/macsec/interfaces/interface/state/enable:
208217
/macsec/interfaces/interface/state/replay-protection:

0 commit comments

Comments
 (0)